AWSManagedMachinePool triggers multiple node rotations when bootstrap secret and AMI change together

[MinhNguyen-at]

/kind feature

When updating both the bootstrap data secret (proxied via MachinePool) and the AWSManagedMachinePool in a seemingly (both resources are actually updated independently) single apply (commonly done GitOps), the AWSManagedMachinePool controller triggers two separate node rotations instead of one.

This creates unnecessary churn and extends maintenance windows. This can be problematic when node rotations are slow due to tight PDBs.

Ideally the controller would either:

• Debounce launch template changes within a short window before triggering a node group update
• Provide a mechanism to batch changes (e.g., an annotation to signal "more changes coming")
• Allow controller to control when updates are triggered (e.g. annotation computed hash of AWSManagedMachinePool + Bootstrap)

** Workaround **
Currently using cluster.x-k8s.io/paused annotation on the AWSManagedMachinePool, applying changes, then removing the annotation. This is workable but less than ideal.

Environment:

• Cluster-api-provider-aws version: latest
• Kubernetes version: 1.32
• OS (e.g. from /etc/os-release): Not Important

[k8s-ci-robot]

This issue is currently awaiting triage.

If CAPA/CAPI contributors determines this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.